PaperCut chained RCE: Two CVEs, one pre-auth shell, patch before September 11
PaperCut NG and PaperCut MF are print management platforms used by thousands of organizations globally, including universities and large enterprises. They are the kind of software that IT teams install, configure, and then largely stop thinking about. That is exactly the environment where this kind of vulnerability chain causes the most damage.
The vulnerability chain
On August 27, 2026, PaperCut disclosed two zero-day vulnerabilities under active exploitation.
CVE-2026-81578 (CVSS 8.8) is an authorization bypass. The flaw allows an attacker to send a specially crafted request to the PaperCut web management interface that references one page for rendering while triggering administrative backend functions on another page. PaperCut's authorization checks evaluated the rendered page, missing the permission check for the backend action. Result: unauthenticated configuration changes to the server.
CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading vulnerability in the database connection utilities. With the right configuration change in place, an attacker can trigger class loading from attacker-controlled resources, leading to arbitrary code execution on the PaperCut Application Server.
The chain: use CVE-2026-81578 to make the unauthenticated configuration change that enables CVE-2026-82078, then trigger CVE-2026-82078 for pre-authentication RCE. No credentials required at any step.
Why there were two emergency patches
PaperCut issued an initial emergency patch on August 27 working with researchers from watchTowr and Huntress. Within 24 hours, researchers had found bypasses in the initial fix. Emergency Patch Release 2 came on August 28. As of that date, EPR2 is the version organizations should be running.
The fact that the first patch was bypassed is worth noting not to pile on PaperCut, but because it reflects a real pattern with complex authorization flaws: the initial fix addresses the specific bypass route disclosed, and researchers promptly find adjacent routes through the same logic gap. Organizations that patched on August 27 should verify they have EPR2 installed.
Scope and deadlines
The vulnerability affects all versions of PaperCut NG and PaperCut MF prior to August 27, 2026 across Windows, Linux, and macOS. Emergency patches are available for versions 24, 25, and 26.
CISA added both CVEs to the Known Exploited Vulnerabilities catalog on August 31. Federal Civilian Executive Branch agencies must patch CVE-2026-82078 by September 11 and CVE-2026-81578 by September 14. Non-federal organizations are not bound by FCEB deadlines, but CISA's inclusion of a vulnerability in KEV reflects confirmed active exploitation across real organizations.
Immediate remediation steps
Apply EPR2 for your PaperCut version (24, 25, or 26) on all platforms. Verify the installed build number matches the Emergency Patch Release 2 version published August 28.
If patching is not immediately possible: restrict access to the PaperCut web management interface (default port 9191) to trusted management networks only. This reduces the attack surface but does not remediate the vulnerability.
Review access logs on PaperCut servers for anomalous configuration changes or unusual class-loading activity in the week preceding the disclosure, given active exploitation predated the patch.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch your organization needs guidance on patch prioritization under CISA KEV deadlines.